Significant research and resources have been applied in developing, implementing and maintaining secure payment systems which facilitate the use of credit/charge cards by cardholders in commercial transactions conducted over the Internet.
All of these secure systems are based on cardholders having to “process” their card number each time, which leaves the “capturing” of card numbers and related information transmitted at time of purchase, open to hackers and/or other fraudsters who can gain access to card numbers and expiry dates.
One solution is to use secure (encrypted) methods of communication in sending credit card details over the Internet to a merchant when making a purchase. Examples of such secure methods include Secure Socket Layer (SSL) and the Secure Electronic (SET) protocol. These methods have been developed by leading computer companies and businesses in the credit card industry specifically for the purposes of performing electronic transmission of credit card details on the Internet. However, there is no guarantee that the credit/charge card details whilst transmitted somewhat securely are not vulnerable to attack when stored on the merchant's system. It is a strong possibility that the card details could be hacked or used by a merchant or an employee of the merchant for fraudulent purposes.
A further concern mitigating against on-line commerce, as perceived by cardholders, is the reliability of the e-commerce merchants and the lack of recourse available to card holders having made a purchase. The cardholder has no guarantee that items ordered will be delivered in a timely manner and be of an appropriate quality and/or quantity etc. It may be difficult, once card details have been supplied and appropriate funds debited to the cardholder's account, for a cardholder to obtain proper satisfaction from the merchant.
A further concern is that there is no guarantee that a merchant, or associated personnel who may have access to the cardholders details, will not use the cardholders card details in subsequent unauthorised transactions, or pass the information onto third parties for criminal purposes.
On the other hand, a significant concern for merchants is that items are definitely settled for before dispatch, i.e. that the card details and amount has been “approved” for settlement by the card scheme acquirer and that the card details and cardholder information is genuine.
EP 0801479 discloses a secure communication mechanism for communicating credit card or other sensitive information between a cardholder terminal and a server which communicate over a data network (e.g. Internet). For secure or private communication of sensitive information over a data network, a telephone connection is established between the originating Internet Service Provider (ISP) server to which the cardholder is connected for access to the data network and the server provider to which the sensitive information is directed. Any communications or transactions to a terminating ISP server involving credit card or other sensitive information are effected, however, on a second connection through a telephone call placed to a telephone number of the terminating ISP server. After receiving a call, and by associating such call with the cardholder's request over the Internet for information and/or interactive services, and/or non-electronically deliverable goods or services, the ISP provides the cardholder with the requested information and/or service, or approves delivery of the non-electronically deliverable goods or services. With this arrangement, payment is effected without providing credit card information via the Internet routing servers and without establishing a financial relationship with the ISP. Preferably, the communication of information over the telephone line between the originating server and the terminating ISP server is also subject to encryption. The problem with this approach is that is essential for ISPs and merchants to sign up to the idea and to the installation of additional communications equipment to facilitate the secure communication on the secondary channel. Furthermore, the requirement for a separate telephone call adds additional cost to the process and there is still no guarantee from the cardholder's perspective.
WO97/03410 discloses an Internet billing method comprising establishing an agreement between an Internet access provider and a customer, and an agreement between the Internet access provider and a vendor, wherein the Internet access provider agrees with the customer and the vendor to bill the customer and remit to the vendor for products and services purchased over the Internet by the customer from the vendor. The provider creates access to the Internet for the customer. When the customer orders a product or service over the Internet from a vendor, transactional information transmitted between the customer and the vendor is also transmitted to the provider. The provider then bills the transaction amount to the customer and remits a portion of the transaction amount to the vendor, keeping the differential as a fee for providing the service. As a result of this method, there is no need for any customer account numbers or vendor account numbers to be transmitted over the Internet, thereby maintaining the security of that information. An immense difficulty with this approach is that agreements are required between the ISP's and merchants before any transactions can take place.
U.S. Pat. No. 5,905,736 discloses a method for performing centralised billing for transactions conducted over the Internet between a cardholder and an Internet Service Provider through an Internet Access Provider (IAP). Upon connection of the cardholder's terminal to the LAP, the IAP transmits to a billing platform a message that associates the cardholder's identity and the temporary Internet Protocol (EP) address -that is assigned by the IAP to the cardholder's session for use by to that cardholder's terminal. In response to a chargeable transaction with an ISP, the ISP transmits to the billing platform the IP address of the cardholder making the transaction and the charge for the transaction. The charges for all such transactions are accumulated by a transaction server and stored in an account on an associated database identified with the IP address of the requesting terminal. At the end of the cardholder's session, the charges for all the transactions during the session that are stored on the transaction server database in the account identified with the IP address, are charged to an account associated with the cardholder's identity that is stored on a database of a billing server by cross-referencing the IP address to the cardholder's identity from the previously received and stored message.
In consideration of the prior art, it would be advantageous if a method of purchasing goods on-line could be provided which would permit a cardholder to have a simple and efficient recourse to the e-commerce merchant in the event of a complaint.
It would further be desirable, if a method could be provided, which would allow a consumer to make a purchase on-line without disclosing their card details to third parties.